Send the signal. Keep the state.

import crypto from "node:crypto";
import express from "express";

const app = express();
const secret = process.env.PINGROOM_SIGNING_SECRET;

app.post(
  "/hooks/pingroom",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const rawBody = req.body;
    const timestamp = req.get("X-PingRoom-Timestamp") ?? "";
    const deliveryId = req.get("X-PingRoom-Delivery") ?? "";
    const signatureV2 = req.get("X-PingRoom-Signature-V2");
    const signatureV1 = req.get("X-PingRoom-Signature") ?? "";
    const hasV2 = signatureV2 !== undefined;
    const age = Math.abs(Date.now() / 1000 - Number(timestamp));

    if (!secret || !Number.isFinite(age) || age > 300) {
      return res.sendStatus(401);
    }

    // V1 is considered only when the V2 header is absent.
    const prefix = hasV2
      ? `v2\n${timestamp}\n${deliveryId}\n`
      : `${timestamp}.`;
    const expected = crypto
      .createHmac("sha256", secret)
      .update(prefix)
      .update(rawBody)
      .digest("hex");
    const received = hasV2 ? signatureV2 : signatureV1;
    const a = Buffer.from(expected, "hex");
    const b = Buffer.from(received, "hex");

    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.sendStatus(401);
    }

    const event = JSON.parse(rawBody.toString("utf8"));
    // Enqueue event and dedupe by deliveryId, then ACK fast.
    return res.sendStatus(200);
  },
);

Parse JSON only after verification. Re-serializing the object changes the signed bytes.